0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

History

kevinveenbirkenbachandClaude Opus 5.5 3855b75c5f fix(sys-ctl-hlth-journalctl): read long and repeated MESSAGE fields

Without `--all`, `journalctl --output=json` encodes a field over 4096
bytes as `null`, so a long host error matched nothing and the check
passed. A repeated `MESSAGE` field arrives as a JSON array of its
values, and `bytes()` on that array raised `TypeError`, which aborted
the whole check.

Pass `--all`, and tell a byte array (all integers) from an array of
field values, decoding each value on its own.

Reproduced against the host journal: a 5000-byte error line read back
as `"MESSAGE":null` and produced no match; an entry with two `MESSAGE`
fields, sent over the native journal socket, read back as
`["error first","error second"]` and crashed `host_errors` with
`TypeError`. With the fix both are reported.

Also clear the two test-lint findings of this PR:
`test_comments_valid` rejects the narrative comment above the
`journalctl` Popen, so it goes; the stderr-to-file choice stays, because
an unread stderr pipe that fills up would block `journalctl` while
stdout is still being read. `test_no_uncached_file_reads` flags the
read of the stub's argument file, which lives in the test's tempdir and
is written per run, so the path-keyed `utils.cache.files.read_text`
could serve a stale body; the read opts out with
`# nocheck: cache-read tempdir fixture`, as the other stub-driven
script tests do.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-16 22:11:09 +02:00

files/python

fix(sys-ctl-hlth-journalctl): read long and repeated MESSAGE fields

2026-10-16 22:11:09 +02:00

README.md

sys-ctl-hlth-journalctl

Description

Scans journalctl over the last day for “error” entries outside container logs and alerts if any are found.

Overview

This role searches the systemd journal for errors over the past day and alerts if any are found. Container output is skipped, because every compose service logs to journald and application errors would otherwise trigger the host check. Docker daemon and system errors are still reported.

Cosmos

The diagram places sys-ctl-hlth-journalctl in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-ctl-hlth-journalctl 💻]
        svc_journalctl["journalctl"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

Reads the last day of the journal as JSON with every field in full (--all) and drops every entry that carries a CONTAINER_ID field.
Joins a repeated MESSAGE field into one line before matching.
Matches the remaining messages case-insensitively against error.
Prints one source: message line per match, naming the systemd unit or, without one, the syslog identifier, so alerts show who logged the error.
Exits non-zero on matches, and also when journalctl itself fails, so a broken check never passes silently.
Scheduled via systemd timer.
Alerts via sys-ctl-alm-compose on detection.

Usage

Include the role; set on_calendar_health_journalctl for your preferred schedule.

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).